DIGITTPAY SOLUTIONS LLP

This Policy establishes a risk-based customer identification and verification framework for DIGITTPAY SOLUTIONS LLP. It is intended to support customer protection, fraud prevention, lawful onboarding and applicable AML/KYC obligations to the extent they apply to the Company's actual legal role, products and transaction arrangements.

KYC obligations vary according to the Company's legal status, product structure, regulated role, payment flows, contractual arrangements and applicable law. This Policy shall not be interpreted as creating a regulatory obligation where none applies. Where a bank, payment partner, regulated entity, network or applicable law requires specific customer verification, the Company shall follow the applicable requirement.

• Establish proportionate customer identification and verification controls.
• Reduce identity misuse, fraud and account abuse.
• Support risk-based customer onboarding and monitoring.
• Maintain appropriate verification records.
• Escalate suspicious or high-risk activity under applicable policies.

This Policy applies to customers, users, merchants, business customers or other counterparties for whom identification or verification is required by applicable law, product design, partner requirements or Company risk controls.

The Company may classify customers or relationships based on relevant risk factors such as product usage, transaction behaviour, geography where relevant, fraud indicators, account characteristics, partner requirements and applicable legal criteria.

Where verification is required, the Company shall collect information reasonably necessary to identify the customer or counterparty and provide the relevant service, subject to applicable privacy and data-minimisation requirements.

• Approved identity or business documents
• Authorised electronic verification methods
• OTP or account ownership verification
• Bank or payment-instrument verification where applicable
• Business registration or ownership verification for business customers
• Partner-provided verification where contractually and legally acceptable

Documents and information collected shall be appropriate to the customer type and applicable verification requirement. The Company shall avoid collecting unnecessary personal information.

Where business customers or merchants are onboarded, verification may include legal name, registration details, authorised representative, beneficial ownership information where required, business activity, settlement information and relevant licences or permissions.

Where applicable to the Company's legal and contractual obligations, beneficial ownership information shall be obtained and verified using reasonable and permitted methods.

Where required by applicable law, regulation, partner requirements or the Company's risk framework, customers or counterparties may be screened against applicable sanctions or restricted-party information. Potential matches shall be reviewed before taking action.

• Mismatched identity information
• Repeated failed verification
• Multiple accounts showing suspicious common characteristics
• Unusual transaction or voucher behaviour
• Use of compromised or suspicious credentials
• Patterns associated with account takeover or identity misuse

Where risk warrants additional verification, the Company may request additional information, apply enhanced monitoring, restrict certain activities or require review by authorised personnel, subject to applicable law and customer terms.

Based on available information and applicable requirements, an account or relationship may be approved, conditionally approved, held for review or declined. Decisions shall be based on documented risk or service requirements and applied consistently.

Where appropriate, customer information may be refreshed periodically or when material changes, unusual activity, fraud indicators or applicable requirements trigger re-verification.

Customer verification operates alongside transaction monitoring, fraud prevention and transaction-limit controls. Verification status may be considered as one input to risk decisions but shall not by itself determine that a transaction is fraudulent.

Where AML/CFT obligations apply, customer identification, risk assessment, monitoring, escalation and record-keeping shall be coordinated with the Company's AML-CFT Policy and applicable legal requirements.

KYC and verification information shall be collected, used, stored, accessed, shared and retained only for authorised purposes and with appropriate security and privacy controls.

Where an authorised vendor or partner performs verification, the Company shall apply proportionate vendor due diligence and contractual controls, including confidentiality, security, permitted use and incident notification.

Where required verification cannot be completed or information is materially inconsistent, the Company may pause onboarding or relevant activity, request additional information or decline the relationship, subject to applicable law and customer terms.

Verification requirements shall be communicated through appropriate customer-facing channels. The Company shall avoid disclosing sensitive fraud-detection or security logic where doing so could facilitate circumvention.

Verification information, decisions, risk assessments, relevant screening results and supporting records shall be retained according to applicable legal, contractual and Company retention requirements.

KYC and verification records shall be accessible only to authorised personnel with a legitimate business, compliance, fraud, legal, audit or operational need.

Unauthorised access, loss or disclosure of verification information shall be handled under the Information Security and Incident Response policies, with privacy and legal escalation as applicable.

Personnel involved in onboarding, customer verification, fraud prevention, compliance or support shall receive role-appropriate training on verification procedures, privacy, fraud indicators and escalation.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory, partner or security requirements shall not be bypassed.

This Policy shall be reviewed at least annually and following material changes in applicable law, regulatory status, products, customer journey, payment arrangements, partner requirements or audit findings.